How do I access the raw value of a Sensitive in EK9?

  HttpClient with trait of Privileged
    sendRequest()
      -> apiKey as Sensitive
      header <- apiKey.reveal()

  - Classes without the Privileged trait → E11090
  - Functions (cannot have traits) → E11090
  - Dynamic classes without Privileged → E11090

  - Regular classes with 'with trait of Privileged'
  - Named dynamic classes with 'trait of Privileged'
  - Unnamed dynamic classes with 'trait of Privileged'

defines module qa.security.privilegedreveal

  defines trait

    SecretConsumer
      consumeSecret() as abstract
        -> secret as Sensitive

  defines class

    <?-
      A class WITH Privileged can call reveal() to access raw secret value.
      Only infrastructure code like HTTP clients should do this.
    -?>
    HttpClient with trait of Privileged

      sendAuthenticatedRequest()
        -> token as Sensitive

        rawToken <- token.reveal()
        stdout <- Stdout()
        if rawToken?
          header <- `Bearer ${rawToken}`
          stdout.println(`Auth header set: ${length header} chars`)

    <?-
      A class WITHOUT Privileged can safely handle Sensitive values
      using redaction, comparison, and copy - but NOT reveal().
    -?>
    SafeLogger

      logActivity()
        -> credential as Sensitive

        stdout <- Stdout()
        if credential?
          //$ always returns ***REDACTED*** - safe to log
          stdout.println("Activity with credential: " + $credential)
        else
          stdout.println("No credential for activity")

      default operator ?

  defines function

    <?-
      Named dynamic class with Privileged can call reveal().
    -?>
    testNamedDynamicReveal()
      env <- EnvVars()
      secret <- env.sensitiveGet("DB_PASSWORD")

      extractor <- PasswordExtractor(secret) trait of Privileged as class
        getPassword()
          <- pwd as String?
          pwd: secret.reveal()
        default operator ?

      if extractor?
        result <- extractor.getPassword()
        stdout <- Stdout()
        if result?
          stdout.println(`Password extracted: ${length result} chars`)

    <?-
      Test that non-Privileged code can still work with Sensitive values.
    -?>
    testSafeOperations()
      stdout <- Stdout()
      env <- EnvVars()

      secret <- env.sensitiveGet("API_KEY")

      //All safe operations - no Privileged needed
      if secret?
        //Auto-promotes to ***REDACTED*** in string context
        stdout.println("Redacted: " + secret)

      backup <- Sensitive()
      if secret?
        backup :=: secret
        if backup?
          stdout.println("Backup created successfully")

    testPrivilegedReveal()
      env <- EnvVars()
      token <- env.sensitiveGet("AUTH_TOKEN")
      client <- HttpClient()
      if client? and token?
        client.sendAuthenticatedRequest(token)

    testSafeLogging()
      env <- EnvVars()
      credential <- env.sensitiveGet("SERVICE_KEY")
      logger <- SafeLogger()
      if logger?
        logger.logActivity(credential)

  defines program

    PrivilegedRevealDemo()
      stdout <- Stdout()
      stdout.println("Privileged trait and reveal() demonstrations")
      testNamedDynamicReveal()
      testSafeOperations()
      testPrivilegedReveal()
      testSafeLogging()

HttpClient

HttpClient with trait of Privileged

PasswordExtractor(secret) as class

PasswordExtractor(secret) trait of Privileged as class

secret <- "sk_test_abcdefghijklmnopqrstuvwxyz"

secret <- env.sensitiveGet("API_KEY")

token <- "-----BEGIN RSA PRIVATE KEY-----"

token <- env.sensitiveGet("AUTH_TOKEN")